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We study, in the context of quantum information and quantum communication, a configuration 
of devices that includes (1) a source of some unknown bipartite quantum state that is claimed to be 
the Bell state and (2) two spatially separated but otherwise unknown measurement apparatus, 
one on each side, that are each claimed to execute an orthogonal measurement at an angle 6 £ 
{— 7r/8, 0, 7r/8} that is chosen by the user. We show that, if the nine distinct probability distributions 
that are generated by the self checking configuration, one for each pair of angles, are consistent with 
the specifications, the source and the two measurement apparatus are guaranteed to be identical 
to the claimed specifications up to a local change of basis on each side. We discuss the connection 
with quantum cryptography. 



I. INTRODUCTION 

Typically, when one considers the task of testing a 
quantum system, for example using quantum state to- 
mography, one makes the assumption that the measure- 
ment apparatus are perfect or reasonably close to perfect. 
Moreover, it is typically assumed that every measured 
system has the correct dimension. In contrast, here we 
consider the problem of testing a quantum system with- 
out trusting the measuring apparatus that are used in 
the test, except the fact that two measurements that are 
space like separated in the ideal specification can be mod- 
eled in the real setting by two silmutaneous quantum op- 
erators on distinct systems. In particular, we assume no 
apriori information about the dimension of the measured 
systems or on the rank of the measurement operators. 
The intuition that applies to ordinary tests where the 
dimensions are correct does not apply here. The prob- 
lem that we have is more difficult. In fact, it will already 
be an interesting challenge to consider the case where the 
probability distribution for measurement outcomes in the 
real setting are identical to the corresponding probability 
distributions in the ideal specification. 

To be more specific, we describe the setting that 
we will consider. The source has specification to emit 
two systems (say photons) A and B in the Bell state 
$+ (100)^-^ + |11)'^'^)/V2. The photons A and 
B are sent to two measuring apparatus, one for each 
photon, that respectively receive the classical inputs 
a,/3 € {— 7r/8, 0, 7r/8} that represent the measurement 
bases {|a-hO), |a-h7r/2) } and { |/3-hO), \P + n/2)}. The 
photons A and B are respectively measured in the bases 
a and /3 and the respective classical outcomes x and y of 
these measurements are noted on each side. 

Let p((a, x), (/3, y)) be the probability of the pair of 
outcomes {x,y) given the pair of measurements (a,/3) 
when the system respects perfectly the original specifica- 
tion. Let p{{a, x), (/3, y)) be the corresponding probabili- 
ties for the actual system which might not be built to the 
orginal specification. Let Q — {— 7r/8, 0, 7r/8}x{0, l},the 
space of pairs (a, x) where a is a basis and x an associated 
outcome. Our main result states that if, V(a, b) e we 



have p(a, b) — p{a, b), the setting is neccessarily identical 
modulo some local isomorphisms (see section III) to the 
original specification. This result would not be surprising 
at all if we assumed that the two measured systems are 
two dimensional systems or that the measurement opera- 
tors are executed on two dimensional systems, but we do 
not use any assumption of this kind here. No assumption 
on the measuring apparatus or the source are required in 
our proof of the theorem, except that before a measuring 
apparatus receives its choice of basis and until after the 
measurement is executed, the apparatus (and whatever 
has selected the basis) is isolated from the other measur- 
ing apparatus. In the specific context of quantum key 
distribution, this separation assumption is also needed 
after the measurement to guarantee the privacy of the 
generated key, but this is another issue. If we only worry 
about testing the source, we only need the separation as- 
sumption until after the test is executed. This separation 
assumption is only an assumption on the device or mech- 
anism that is used to isolate the measuring apparatus; it 
is not a direct assumption on the measuring apparatus. 

If the actual system is not built to the original specifi- 
cation, we might have p{a, b) ^ p(a, b). A test could even- 
tually be executed to check how close the probabilities 
p{a, b) are to the ideal case p{a, b). A robust variation on 
the theorem should consider the case \p{a, b)—p{a, b)\ < e, 
but we do not do this analysis. The problem and the 
main theorem are described in section III. A specific 
connection with the BB84 protocol [2] in quantum cryp- 
tography is discussed in section IV. Finally, the proof of 
the theorem is provided in section V. 



II. RELATED RESULTS 

The result is interesting from both a purely theoreti- 
cal point of view and a practical point of view. We hope 
that it will have application in different areas of quantum 
information processing. The result was obtained in a spe- 
cific context, the unconditional security [1] of a variation 
on a protocol proposed by Bennett and Brassard in 1984 
[2]. For concreteness, we first explain this (variation on 
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the) protocol. In this protocol, Alice sends many photons 
to Bob in one of the four polarisation states \a + xtt/2), 
a e {— 7r/8, 7r/8}, x G {0,1}. Usually, in the literature, 
the bases are at angles are and 7r/4 instead of — tt/S 
and 7r/8 as we have here, but this is symmetrical. Bob 
measures each received photon in one of these two bases 
chosen uniformly at random and notes the outcome y. 
Let fl be the set of positions where Alice and Bob used 
the same basis. For each postion in because Alice and 
Bob used the same basis, in principle they should share 
the same bit x = y. After the quantum transmission, 
Alice and Bob announce their bases, and therefore they 
learn the set il. Eve also learns the bases used by Al- 
ice, but it is too late for Eve because the photons are 
already on Bob's side. Alice and Bob execute a test on 
a subset T C fl and count the number of errors in T. If 
too many errors are detected the test fails and the pro- 
tocol aborts. Otherwise, the set T is thrown away and 
the protocol continues. Alice announces redundant bits 
about E = — T and Bob uses this extra information 
to correct the errors m E. At this point, Alice and Bob 
should share a string of bits on E which we call the raw 
key. Eve has obtained some information about the raw 
key from the redundant information or directly because 
she eavesdropped on the quantum channel. To address 
this problem, Alice and Bob generate a final key k in 
which each bit ki is the parity of some subset Ki C E 
of the raw key bits, a well known technique to extract a 
final key from the raw key [3]. As proven in [1], if the 
number of parity bits is not too large, the final key will 
be almost perfectly secret, that is, with almost certainty 
either the test fails or Eve has almost no information 
about the final key. The connection between this proof 
and our result is given in section IV. 

The novelty of the problem that we consider is that the 
apparatus that are used in the protocol can be defective. 
There is no perfect solution to this problem. Therefore, 
every tool that can be used to improve the situation is 
normally welcome and our theorem is such a tool. Be- 
fore we explain in which way our theorem helps, let us 
describe the basic steps that should be taken even be- 
fore we use this theorem. The first basic step is simply 
to propose assumptions that directly say that the source 
is close to the ideal specification. The second basic step 
is to justified each of these assumptions (as much as an 
assumption can be) by considering the specific technol- 
ogy used. An example of such a direct assumption is an 
upper-bound on the ratio of multi-photon signal that is 
emitted by a source. In this case, the required technology 
could be a strong signal of light followed by an attenua- 
tor. The intensity of the strong signal is measured and 
then the attenuator is used to reduce the intensity of the 
signal to the desired level. It turns out that this specific 
technology is reasonably trusted. In the same way, a di- 
rect assumption must be proposed and justified for every 
degree of freedom which can encode information. In addi- 
tion to the photon number space, one has to consider the 
frequency space, the polarization space and also we must 



consider the possibility that the information gets encoded 
into a different system. For example, if any mechanical 
system is used, the information could get encoded into 
some vibrational modes. Moreover, one should explain 
(in the general model of quantum mechanics) why all as- 
pects are covered by the proposed assumptions. So the 
task is not easy and it is not a perfect solution. 

Some people might say that these assumptions should 
not be trusted, and a test should be conducted to ver- 
ify them instead. For example, one might propose to 
use a photon detector to test the intensity of the signal 
after the attenuator. Fine, but this leads us to our com- 
plementary approach. The immediate problem that we 
must address is that validity of the test depends on the 
testing apparatus, the photon detector. Let us consider 
what can be done. In 1991, Artur Ekert proposed a pro- 
tocol that was based on EPR pairs and violation of a Bell 
inequality [4]. Though the security analysis of his pro- 
tocol was incomplete, Ekcrt's salient idea of using EPR 
pairs and violation locality in a protocol is far reaching. 
First, if the parties on both sides have trusted measuring 
apparatus, the idea of using an untrusted source of EPR 
pairs takes care of the defective EPR source issue by itself 
(without any use of violation of locality) . Ekert's analysis 
considered the case in which we have perfect measuring 
apparatus. A little bit later, it was strongly suggested in 
[6] that violation of a Bell inequality (which is more than 
just using EPR pairs) does not help in quantum cryp- 
tography unless the purpose is to verify the quantum 
apparatus. In the context of trusted quantum appara- 
tus, violation of Bell like inequalities might not provide 
better security. Moreover, to our knowledge, it didn't 
help as a theoretical tool to obtain a better bound on 
Eve's information. However, with violation of locality, 
one can hope to test both a defective source and defec- 
tive measuring apparatus. Ekert did not explicitly pro- 
pose that we should use violation of locality to test both 
the EPR source and the measuring apparatus, but the 
idea was implicitly there. It was there, but remained un- 
used until the work of [7] in which violation of locality 
was used to test both the source and the mcasiiring appa- 
ratus (see also [11]). Two papers reported experimental 
work that was based upon Ekert's protocol (or a similar 
protocol) [9, 10]. The purpose of some these papers was 
to address the imperfect apparatus issue. They cite Ek- 
ert for his protocol. However, nobody knows if Ekert's 
protocol meets the objective. Even Ekert did not claim 
that. His main focus was not to test defective apparatus. 
There are other connections between quantum cryptog- 
raphy and violation of locality or Bell inequalities that 
focus less on testing defective apparatus than the current 
paper does, but are not less interesting [12]. 

This paper, following [7], shows that, except for the 
location of each apparatus and the time at which they 
receive their input, we can assume that Eve has designed 
both the EPR source and the detectors. In practice, to 
conduct a test on the source, we also need the assumption 
that the different executions of the overall configuration 



3 



in the test are identical and independent. Our main tool 
is violation of classical locality. In the context of un- 
trusted source and untrusted measuring apparatus, it is 
not clear whether or not a violation of a Bell inequal- 
ity, especially if it is only sligthly violated, implies that 
a private key can be generated. Therefore, in this con- 
text, it is not sufficient to detect a violation of a Bell 
inequality to claim that a protocol is secure. So, our 
statement is not that violation of locality implies secu- 
rity. We use violation of locality indirectly by considering 
an ideal setting that is known to violate a Bell inequality 
and by restricting ourselves to attacks that generate the 
same probability distribution of classical outcomes as in 
this ideal setting. Again, if the attack modifies the prob- 
ability distribution of these classical outcomes, this can 
be detected by Alice and Bob, but we do not do this part 
of the analysis. Of course, this test will require its own 
set of assumptions. This approach should not be taken as 
a way to avoid the basic steps that are described above. 
Instead, in view of the fact that no solution is perfect, 
we think that the existence of two complementary ap- 
proaches is very much welcome. 



III. THE PROBLEM AND THE MAIN RESULT 

An apparatus emits an unkown system A(g) B in some 
unknown state which will be measured by some un- 
known measurement operators 11^, Ilf associated with 
a,b dz O, respectively. Without loss of generality, wc as- 
sume that the source emits a pure state ^f"*^. There is no 
loss of generality because an extra system can be added to 
A or _B to purify the state. Without loss of generality, wc 
can further assume that the defective measurement op- 
erators and nf respectively associated with a and b 
are orthogonal. An auxiliary system in some known state 
can be added to the measured system to replace a general 
POVM on this system by an orthogonal measurement on 
the extended system [15] . The ideal projection on the sys- 
tem A (B) associated with an element a G G (6 G O) is 
denoted (P^^). We define p(a, 6) = \\Pa^Pb^\^AB)f 
andp(a,6) = l|n;^nf|*^^)f. 

As we explained in the Introduction, the hypothesis 
in our main result (theorem 1) are p{a,b) = p{a,b), 
nf = (g) and n§ = I^(g) P^. Different sys- 
tems [P^ ^ ^'^ j^g) can generate the same probabili- 
ties p{a,b). Let A (B) be the support of the residual 
density matrix of after a partial trace over B (A). 
The definition of P^ and P^^ outside A and B respec- 
tively cannot affect the probabilities p{a,b). Therefore 
the only constraint that we can hope to obtain on 
(P(f ) will have to be a constraint on p/ '''= P^P^P^ 
^pB "^j/ p^pBp^j^ where P^ (Pb) the projection on 
the subspace A (B) of A (B). Our result takes this fact 
into account. 



Another point is that the defective system A (the same 
for B) might not contain any qubit, that is, there might 
not exist any qubit A such that, for some other compo- 
nent Ea, we have A = Ai^Ea- A unitary transformation 
on A can correspond to a change of basis in A, but it will 
not c;reate a qubit because of the trivial fact that the 
final space is still A. If the space A already had a ten- 
sor product structure, a unitary transformation on this 
space could change a pure state into an entangled state, 
and this could be interpreted as a modification of the ten- 
sor product structure of the state but not of the space. 
If the space A has no tensor product structure, a unitary 
transformation on A will not create one. In opposition, 
we would like to conclude that somehow the subspace A 
(B) of the defective systems A (B) contains the correct 
qubit A (B). One solution is simply to add an extra qubit 
A (B) initially in the state 10)"* (|0)^) and then consider 
a local unitary transformation defined on A(g) A {B (g) B) 
that will extract the information about the correct qubits 
in A (B) and swap it into A (B). Another formal solu- 
tion is to consider an isomctry from A to A (E) Ea- An 
isometry is the same as an unitary transformation except 
that it can change the tensor product structure because 
the final space is not the same as the initial space. 

Definition 1 A linear transformation U from a space V 
to a space W is an isometry if and only if V and W have 
the same dimension and U preserves the inner product 
between any pair of states in V. 

Theorem 1 For every setting {P^ , P^ , 'i' ^b) such that 
p{a,b) = p{a,b), P^ acts on A only and P^ acts on 
B only, there exists two "garbage" spaces Ea and Eb, 

a state EaEb S Ea 55 Eb- an isometry from A to 
A^Ea and an isometry Ug from, B to B®Eb such that, 

• for every a e 6, U^P^U\ = {P^ ® Ie^), 

• for every b e 6, U^P^Ul = {P^ <S) Ies), 

• (t^A ® U^)^AB = i^AB ^ ^E^En)- 

This theorem essentially states that the real system 
is identical to the ideal system {{P^ ® lEB),{Pa ® 
Iea)^ ^ab ® ^EaEb ) up to a local change of basis (that 
can modify the tensor product structure) on each side. 

The system {{P^®Ies), {P^®Iea), ^\b®'^EaEs) fol- 
lows exactly the original specification except for an addi- 
tional system Ea Si' Eb that is in some pure state EaEb 
which doesn't interfer at all with this specification. One 
cannot hope to prove more than theorem 1 using only 
Pa{x) = Pa{x). The proof will be given in section V. 

IV. CONNECTION WITH THE BB84 
PROTOCOL 

There are different ways in which our main result could 
be connected to a security proof. In particular, our self- 
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checking apparatus can be used in the BB84 protocol in 
two different ways. In one way, the two measuring appa- 
ratus in our self-checking apparatus are on Alice's side. 
This is the approach that we will describe here. It corre- 
sponds to the original idea of a self-checking source en- 
tirely located on Alice's side. The other approac h is that 
the two measuring apparatus are respectively located on 
Alice's side and on Bob's side. We will not discuss this 
other option here. 

We recall that we consider a variation on the BB84 
protocol where every state is rotated of an angle — tt/S 
so that the bases used arc at angle — vr/S and vr/S instead 
of and 7r/4 as is usually the case in the literature. When 
Alice picks a — {— 7r/8, tt/S} for the measurement on the 
first photon and obtains the outcome x, the second pho- 
ton collapses into the state \a+x'n:/2), as requested in the 
BB84 protocol. However, our test requires that Alice uses 
the three angles —tt/S, and 7r/8 for the two photons. 
Therefore, to test the apparatus Alice will pick a random 
set of positions R and the bases a, /3 G {— 7r/8, 0, tt/S} for 
the positions in this set. For the non tested positions (i.e. 
the positions not in R), Alice will use a G {— 7r/8,7r/8} 
for the first photon and send the other photon to Bob. 
The basic intuition is that, if the test really works, it 
should be unlikely that this test succeeds on R and would 
fail if it was executed outside R. 

Let us prove that, whenever the source respect the con- 
clusion of theorem 1, the protocol is as secure as if an 
ordinary BB84 source was used. It is convenient to con- 
sider Uj^^SiUj^ as a change of bases which provides an 
alternative representation for the states of the subsystem 
A® 13. In this alternative representation, it is not hard 
to see that if (a, x) is used/obtained on ^'s side, the sys- 
tem B (g) Ea ® Eb must be left in the collapsed state 
\a + X'k/2) ® '^EaEb- If we return to the original repre- 
sentation, the collapsed state is (f/^ (g) U^)\a + x'k/2)-^ (g) 
\a + x'k/2)^ (g) '^EaEb- The transformation Uj^ has no 
effect on i?'s side, so it's the same thing as if Eve received 
the part B ® E'b of U^\a\ + Xi-k/2)"'^ 'Si'^EaEb ■ An im- 
portant fact is that Ug and '^EaEb *re independent of a 
and X. Therefore, with the state \a+X'K/2)^ and the part 
Eb of the state ^EaEb Eve could herself create the state 
Ug\a + xTr/2)^ g) ^EaEb- Therefore, Eve has nothing 
more than what she could obtain if the ordinary BB84 
source was used together with a completely uncorrclatod 
state ^EaEb that is initially shared between Alice and 
Bob. 



V. THE PROOF 

Here we prove the main result (theorem 1). Theorem 
1 is given in terms of two local isometrics and 
which preserve the tensor product structure of the sub- 
space Ag)i? of Ag) j5. We will also need a simpler notion 
of isomorphism which ignores the tensor product struc- 
ture of the space A (g) B. If we do not care about the 
tensor product structure, there is a smaller space which 



contains ^^'^ ^^^^ space is sufficient to describe the 
essential of the projections and P^^. This space is 
the span S of {{P^ (g Pi)-^AB \a,beQ}. 

Definition 2 Consider any setting {P^ , P^, "^ab)- "^^^ 
setting {P^ ,P^,'^ is inner product isomorph to 
(P^,P(P,$^^) if there exists an isometry U from the 

span S of {{P^ (g Pff )*ij3 \ a,b e 0} to A® B such 
that, for every a, 6 G 8, for every \(j>s) G -S*, we have 

Al: {P^ ® P,^)|(/.s) = U^P^ ® P^Wm and 

A2:U^A^ = ^\^. 

The proof of theorem 1 proceeds in two main steps. 
First, we prove that the equality p{a,b) = p{a,b) im- 
plies that {P^ ,P^,^Ag) is inner product isomorph to 
(P^, Pj^ , ^ab)- Second, we show that this isomorphism 
implies the conclusion of theorem 1. The reader might 
find the second step a little bit surprising because S, the 
span of {{Pa Pb)^AB \ <i,,b € G}, is not necessarily 
identical to A®B. In fact, S is not in general the tensor 
product of two Hilbert spaces. As we will see, the trick 
is that the inner product structure A g) P can be recon- 
structed because the projections P^ and P^ are defined 
on A and B separately. 

A. The inner product isomorphism. 

Throughout this subsection we assume that the 
equality p{a, h) = p{a, b) hold and we try to show 
that (Pj^ , P,^ , ab) inner product isomorph to 
{Pa, Pb 1 ^is)- We have 6 possible values for a (3 bases 
with 2 outcomes each) and 6 possible values for 6, so a to- 
tal of 36 possible (non normaHsed) states {Pa®Pb)^AB- 
If our goal can be achieved, these 36 vectors should lie 
in a 4 dimensional space and be linearly related as in 
the ideal specification. For every a € {— 7r/8, 0, 7r/8}, let 
©a = {(q;, 0), (a, 1)}. To achieve our goal we have that 
the lenght of these vectors are uniquely determined by 
the probabilities p{a,b). We also have that, for every 

a e {-tt/S, 0, tt/S}, Eaee„ = Ebee^ Pb^ = I, 
and also the commutativity of P^ and P^^. The proof of 
the inner product isomorphism proceeds in three steps. 
In the first step, we show the following simple proposi- 
tion. 

Proposition 1 For every a G Q, 

P^P^'^AB = P^P^^AB = Pa'i^AB = P> AB' 

In the second step, we show this other simple proposition. 

Proposition 2 For every {a, (3) E {— 7r/8, 0, 7r/8} with 

def 

a ^ 13, the four non normalised vectors in B{^a,i3) = 
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{PaP^'^AB I ^ 0ai& S ©/s}; '"'G orthogoual and 
have the same length as the corresponding ideal vectors 

^AB- 

Each of these 6 different sets ^(q,/?) of 4 vectors span a 
4 dimensional space. The third and crucial step is to 
show that, for every {a, (3) and {a',f3') with a ^ (3 and 
a' 7^/3'. the four vectors in B^cc,i3) linearly related to 
the four vectors in Ba',f3' with the same coefficients as for 
the corresponding vectors in the ideal specification. More 
precisely, we must show the following crucial proposition. 

Proposition 3 For every {a, (3) and {a', (3') with (3 
and a' ^ /3' , for every {x,y) G {0, 1}^, 

P(a,x)P(fj.y)'^^AB 

— \^ !rpia',p')-,{x',y') pA pB i 

- 2^ L^(a,/3) \{x,v) ^(a',x')^{l3',y')WAB 

(x',j/')e{o,i} 

where [T^^^ •*] is the unique 4x4 coefficient matrix such 
that 

pA pB ^+ 

_ \^ \rp{a',0')^(x',y')-pA pB 

~ ^-'(a,/3) Kx,y) ^{oc',x')^(l3',y')'^AB- 

{x' ,y')^{0,l} 

It is not hard to see that proposition 3 implies that 

the mapping that maps PaPb^AB 1^*° PaPb^^B^ fo'^ 
a, 6 € 8o = {(0, 0), (0, 1)}, is an inner product isomor- 
phism (see definition 2). Indeed, proposition 3 implies 
that any of the 6 sets 13(^^,13) is a (non normalised) basis 
for S that is as good as any other basis to check if a pro- 
jection P^Pb ^as the correct matrix representation. So, 
to check P^P^ , one simply picks the basis B(^a,0) that 

contains P^P^'^ 

Note that proposition 2 consider 24 vectors, and we 
said that there arc 36 outcomes. This can be explained 
by two facts. First, the probabilities are the same in the 
real setting as in the ideal setting and, thus, 6 of these 
vectors vanish because their associated outcome occurs 
with probability zero: for every a € {— 7r/8, 0, 7r/8} 

J^(lo)<i)*AS = <i)J^(io)*lB = 0. (1) 

This brings us back to 30 vectors. Second, proposition 
1 says that the 6 non vanishing vectors P^Pa'^AB ~ 

PaPa'^AB^ a e e, can be written as or 

and thus arc known linear combinations of the 24 vectors 

considered in proposition 2. Now, we prove proposition 1. 

Proof of proposition 1. We have PaPa'^Aii ~ 
Pa^AB because the collapse associated with the projec- 
tion P^ on Pa'^AB occurs with probability 1. Similarly, 
PaPa^AB = ^a^AB- % commutativity, we obtain 
P<fp/*^^ = P^P^^^AB- By transitivity, we obtain 
proposition lb. This concludes the proof. □ 



Proof of proposition 2. The orthogonality of the four 
vectors PaPb^AB^ a & Qa and 6 G 9/3, is immediate 
from the fact that P^ is orthogonal to P^ ^-^ , is 
orthogonal to P^^ and the commutativity of P^ and 

P^. The length of the vector P^P^'^ is the same 
as in the ideal specification because it is uniquely deter- 
mined by the probability p(a, h) — p{a, h). □ 

Now, we proceed with the third step which we feel is the 
most importany step of the entire proof. 

Proof of proposition 3. Here is a crucial observation 
for the proof. Let (q;,7,/3) be either (— 7r/8, 0, 7r/8), 
(0, 7r/8, — 7r/8) or (7r/8, — 7r/8, 0): a cyclic permutation 
of (— 7r/8, 0, 7r/8). In this way, the value of /? e 
{— 7r/8, 0, 7r/8} uniquely determines a and 7. In the spec- 
ified setting, if we use a fixed basis /3 and a fixed outcome 
z on one side, say the side B, and look at the different fi- 
nal states associated with the two different bases a and 7 
and the two different outcomes and 1 on the other side, 
we see that the 4 different final states lie in the same 
real two dimensional plane. This fact is easily under- 
stood because the system on the non fixed side is a two 
dimensional system and the states in the measurement 
bases are all in the same real plane (no complex num- 
bers). Two of these four states belong to B(^a,0) whereas 
the two others belong to B^^y^j^y 

Note that states that have different value of z are or- 
thogonal. So, the linear relationship between B[a,i3) and 
B(j^j3) does not mix different values of z: the coefficient 

[tI^j'^^]^^ ^ vanishes when z ^ z'. Therefore, it is suffi- 
cient to see, for each value of z individually, how the two 
states associated with (7, (3) and z (below the dotted line 
in figure 1) are linearly related to the two states associ- 
ated [aj]) and z (above the dotted line in figure 1). For 
z = 0,l, let 

d{0,z) = (^(1,0)^(^,2) - -P(7,0)-P(^,z))*AB- 

It is not hard to algebrically check, with the help of 
proposition 1, that the length of 

dp rf(;3,o) +C?(/3,1) = (^(1,0) - ^(7,0))*AB 

is uniquely determined by the probabilities p{a,b) = 
p{a,b). Indeed, we have 

= ll<0)i*AB)ll' - (*iBl^4o)<0)l*AB) 
-(*^bI^(1o)^'(7,0)I*Ab) + ll^(to)l*AB)ll' 

and 

(*ABl^(to)<,0)l*AB> = (*ABl^(to)<,0)l*AB) 

= \\Pio)P(Ld^AB)\\^ 
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and similarly for the term (vf^sl-Pf^ 0)^(7 o)I*ab)- Wc 
also have that the two states li(^^o) and <i(^^i) are orthog- 
onal because they have different value of z. So, we have 
obtained 

= lldlt^ir+lldlttlf. (2) 

After an exhaustive consideration of all cases, one can 
check that in the ideal specification we have that either, 
for both z = and z = 1, z)^^ same 

side of the dotted line (see figure 1) as P^ 0)^(0 z)^ab 
else, for both z = and z = 1, P^ o)^{j3 z)^^ '-'^ ^ 
ferent side of the dotted line than P^ P^ ^ab ■ This 
means that either both ||d|j^';oj|l^ and reach their 

maximum value or else they both reach their minimum 
value. So, we have the following. 

\\di0,.)r<\\d\f;o\f (V^e{0,l}) 

(3) 

\\di0,.)r>\\diis%r (v^e{o,i}) 

If we combine (2) and (3), we obtain ||d(;3,o)||^ = ll<i(^to)ll^ 

and llc?(fl.i)lP = IMf^d'^ijlP- So, the real setting reaches the 
same extreme situation as in the ideal setting where the 
coefficients ' are uniquely determined. This 

shows that the transformation ^ is the same 

as in the ideal case. 

Now, we must consider arbitrary transformation from 
B(a,0) to S(a',/3')> not just from 8(^^,0) to ^(^^^3). By 
symmetry, we also have the transformations from B^c^.p) 
to B(^a,'y)^ that is, we can also change the basis on the 
side B while keeping the same basis on the side A. 
For any (a, /?), {a' , (3') and (a",f3"), the transformation 
from B(a,0) to B(oi",0") the product of the transfor- 
mation from to S(a',/3') with the transformation 
from B^a'.p') to B(a".0")- Using this fact, it is easy to 
obtain all transformations from an arbitrary set B(^a,0) 
to an arbitrary set B(^a',0')- This concludes the proof. □ 



B. The tensor product structure 

Here, we use the result of the previous subsection to 
prove theorem 1. We want to construct two local isome- 
trics and Ug that respects the three conditions of 
theorem 1. Intuitively, the isometry will extract the 
information about the correct qubit that is hidden in- 
side A, and leave A (without this information) as the 
garbage space. It will swap the state of a correct qubit 
that is somehow hidden in A with the state of an addi- 
tional qubit A that is initially in state |0). This is just 
an intuition. 



Formally, we will only show how to obtain because 
can be obtained in the same way with an additional 
qubit B that is initially in the state |0)^. For two qubits 

A' and A, let us denote Naa' the control not operation 
where A is the source qubit and A' the target qiibit. 

Similarly, let us denote Naa' the control not operation 
where A' is the source and A is the target. Let Na and 
Na' be the not operation on A and A', respectively. One 
can easily check that 

Naa'= -P(o,o) ® I A' + P(o,i) ® Na' (4) 
Naa' =Ia® -P(o'o) +Na® P(o'i) , (5) 

and 

Note that Naa' Naa' is the standard swap operation on 
A® A' given that A is initially in the state |0)"*. This 
suggests that we define the swap operation on A® A as 

Uaa ''=NaaNaa (7) 

where the extended control not operations Naa ^^'^ 
Naa^ by analogy with (4), (5) and (6), are defined as 

Naa= Piio) ® + ^(0,1) ® (8) 

and 

Naa''= I a ® P(io) +Na® Pi,) (9) 

where 

N^ V^(-F(>/8,0) ~ -P(-7r/8,0))- 

The swap operation U^^ can be defined in a similar way. 

We recall that the span of {(P^ (g) P^)'^ab \a,beQ} 
is denoted as S. Let us show that that, for every $5 G S, 
for every \a)^ G A, we have 

iUAA^lBm^^'^s) (10) 
= {Ia ® U^)(NaA'NaA' ®Ib')(Ia ® U){\a)'^ ® $s) 

where U is the inner product isomorphism from S to 

A' B' . First, we use the definitions of C/^^, Naa *nd 

A''^^ respectively given in (7), (8) and (9) to expand 

Uj^^ in the LHS in terms of the projections P^ and P^. 
Second, use the condition Al of definition 2 for an inner 
product isomorphism (summing over 6 e 60 to get rid of 

the projections P^) to replace every projection P^ by its 

corresponding projection P^ . This also adds {Ia ® U^) 
to the left and {Ia ® U) to the right. To finally obtain 
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the RHS, we use the identities (4), (5) and (6) to recover 

the expression {Naa'Naa' ®Ib')i but this time on A® 
A' ® B' . We can obtain a similar result for U^^. 

With the help of (10) and condition A2 of the inner 
product isomorphism, we can obtain 

{UaA ® t^Bs)|0)^ ® |0)^ ® ^Ab = ® "^E.Es (11) 

with 

^E.Es = U^m^' ® |0)^'). 

This is essentially the third condition of theorem 1. It is 

not exactly the third condition because it is expressed in 
terms of the swap operation C7^^ and U^^ , not in terms 
of isometrics. The isometry is simply the transforma- 
tion Uj^A where the space A is always in the fixed state 
|0)'^ so that the fixed component |0)'^ does not need to 
appear explicitly in the initial state. The image of on 

A is the image of U^j^ {|0)'^} ® A. It is not hard to 
see using (11) and proposition 4 (provided later) that the 
image of is ^ Ea where Ea is the support of the 
residual density matrix of ^EaEb on A. The isometry U g 
can be defined in a similar way. With these definitions, 
(11) becomes 

(Ua ® Ug)^AB = '^AB ® "^E^En 

which is exactly the third condition. With the help of 
(10), as a first step toward the first condition, we can 
obtain that, for every & S C A® B, 

[P^ ® /^)$s 
= U\{P^®Iab)Ua^s (12) 

and similarly for the second condition for . 

To conclude the proof, it only remains to show that 
{Ua^Ib) docs the right job on A®B, not only on S (i.e., 
Ua is an isometry and fully satisfied the first condition 
of the theorem), and similarly with Uf^ (for the second 
condition). The following easy to prove proposition is a 
key ingredient. 

Proposition 4 Let xy be any entangled pure state of 
a bipartite system X ®Y . Let X he the support of the 
residual density matrix of XY onX. Let Ax and A'^ be 
any two linear operators from X to another space Z. We 
have that Ax^xy = A'^'^xy if and only if Ax = A'^. 
Moreover, the image of Ax on X is the support of the 
residual density matrix of Ax'ifxY on Z. 

Proof. Consider a Schmidt decomposition 
iex 

of '^xY where Ai > for every i G X. Consider 
the projection P^ = on Y. We have that 



Ax^XY = A'-^^xY, if and only if, for every i E X, 
P^Ax'^XY = PY A'^^xY which implies that, for ev- 
ery i G A", Ax\i)^ O \i)^ = ^'xli)^ ® ^ and thus 
Ax\i)'^ = ^xl*)"^- The image of Ax on X is the span 
of {Ax\i)^ I i & X}, but this is also the support of the 
residual density matrix of Ax^xy on Z. □ 

We must show that is an isometry from A to its im- 
age (which wc do not need to know here) , and then check 
that this isometry respects the first condition of theorem 
1. To obtain that Ua is an isometry, it is sufficient to 
obtain that U^a^a is tbe identity on A. We can use the 

definition of Ua in terms of the projections P^ and the 
inner product isomorphism on S (as we did to obtain 
(10)), but this time to obtain that U^Ua^Ab = ^ab 
and then apply proposition 4 to conclude that U^a^a is 

the identity on A. Now, we verify the first condition of 
theorem 1 in a similar way. We want to show that 

Pa=U\{P^<E>lE.)UA 

on A. We simply use (12) with $5 = "^Ab and proposi- 
tion 4. This concludes the proof of theorem 1. 

VI. DISCUSSION 

Thus far, this result was not generalised to a large 
class of settings. Of course, if we only vary the angles 
a little, it will still hold, but nothing is known for more 
interesting variations. For example, it is still an open 
question whether a similar result applies if we used the 
angles {0, 7r/4} on one side and the angles {tt/S, — 7r/8} 
on the other side, instead of {tt/S, 0, — 7r/8} on both sides. 
Also, it is known that the GHZ state can also be self 
tested [19], but no rule is known for a large class of states. 

The theorem was obtained in the context of quantum 
cryptography. It would be useful to obtain a robust vari- 
ation on this theorem in which the probabilities do not 
have to exactly respect the ideal specification. The idea is 
that a statistical test could then be used to obtain enough 
constraints on the source for the purpose of quantum 
cryptography. One may also ask what are the implica- 
tions of this result in the foundation of quantum mechan- 
ics. Somehow, the essential processus of science is that 
we try to figure out what specific models describe the 
observed classical data in different settings. In particu- 
lar, we make hypothesis and then conduct experiments to 
verify them. This is essentially the situation that is anal- 
ysed in our theorem. Therefore, it would be interesting 
to see if the analysis of self-checking quantum appara- 
tus says anything interesting about the way we build our 
different quantum models. If there is a link, it is not a 
trivial link because, typically, experimentalits know what 
their measuring apparatus are when they verify a model 
whereas our theorem applies when the measuring appa- 
ratus on each side are not known. Finally, in view of 
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the fact that configurations such as the one we consider 
in our theorem have been studied for many years in the 
context of violation of BeU's inequahties, it is interesting 
to know that they are uniquely determined (up to a nat- 
ural isomorphism) by the probability distributions that 
they generate. 
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FIG. 1: The vector has maximum length when the 

real plane spanned by P^c,o)P(j),z)^ ab and P^„,i)P(f},z)'^ ab 
(above the dotted line) and the real plane spanned by 

^(7.o)-P(l.)*AB and (below the dotted line) 

are one and the same plane. 



